Keeping an eye on things with pftop

If you're running a system where the local systat does not offer PF related views and you are interested in keeping an eye on what passes in to and out of your network, Can Erkin Acar's pftop is a very useful tool. The name is a strong hint at what it does - pftop shows a running snapshot of your traffic in a format which is strongly inspired by top(1):

pfTop: Up State 1-21/67, View: default, Order: none, Cache: 10000       19:52:28

PR   DIR SRC                  DEST                 STATE   AGE   EXP  PKTS BYTES
tcp  Out 194.54.103.89:3847   216.193.211.2:25      9:9     28    67    29  3608
tcp  In  207.182.140.5:44870  127.0.0.1:8025        4:4     15 86400    30  1594
tcp  In  207.182.140.5:36469  127.0.0.1:8025       10:10   418    75   810 44675
tcp  In  194.54.107.19:51593  194.54.103.65:22      4:4    146 86395   158 37326
tcp  In  194.54.107.19:64926  194.54.103.65:22      4:4    193 86243   131 21186
tcp  In  194.54.103.76:3010   64.136.25.171:80      9:9    154    59    11  1570
tcp  In  194.54.103.76:3013   64.136.25.171:80      4:4      4 86397     6  1370
tcp  In  194.54.103.66:3847   216.193.211.2:25      9:9     28    67    29  3608
tcp  Out 194.54.103.76:3009   64.136.25.171:80      9:9    214     0     9  1490
tcp  Out 194.54.103.76:3010   64.136.25.171:80      4:4     64 86337     7  1410
udp  Out 194.54.107.18:41423  194.54.96.9:53        2:1     36     0     2   235
udp  In  194.54.107.19:58732  194.54.103.66:53      1:2     36     0     2   219
udp  In  194.54.107.19:54402  194.54.103.66:53      1:2     36     0     2   255
udp  In  194.54.107.19:54681  194.54.103.66:53      1:2     36     0     2   271

Your connections can be shown sorted by a number of different criteria, among others by PF rule, volume, age and so on.

This program is not in the base system itself, probably because it is possible to extract equivalent information using various pfctl options. pftop is however available as a package, in ports on OpenBSD and FreeBSD both as sysutils/pftop, on NetBSD via pkgsrc as sysutils/pftop.